ThreatExpert Report: Trojan.SuspectCRC

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 18 September 2012, 02:10:51
Processing time: 8 min 22 sec
Submitted sample:

File MD5: 0xFFC10B29F808E663C456EB67F8F210C8
File SHA-1: 0xD17F33BF5117145108977254D85C6E1F1F346990
Filesize: 1,327,232 bytes
Alias & packer info:

Trojan.SuspectCRC [Ikarus]
packed with: UPX [Kaspersky Lab]

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%DownloadedProgramFiles%\TouchEnKey.dll %System%\TouchEnKey.dll %System%\XecureCK.dll	516,888 bytes	MD5: 0x5E9752F69AA9D5CE4D8061A1FCEB67EE SHA-1: 0x6DC9FEAE156B6E479F8774D25CC36EBFA86ABCB7	(not available)
2	%DownloadedProgramFiles%\TouchEnKey.inf	1,036 bytes	MD5: 0x85CC0EB35F0DAD6F0ADE77B47D006EB3 SHA-1: 0x7DB11445187C953358F2C5A15550E3578205FB68	(not available)
3	%System%\CKAgent.dat %System%\CKAgent.exe	138,320 bytes	MD5: 0xBFEA1ECB48EAE14087C6236F057669C3 SHA-1: 0x8F8A726EE8A86B9896D648D795BB9AF05A20A15B	(not available)
4	%System%\CKApp.dll	199,760 bytes	MD5: 0x296CF23DE6CB2E9AA1BFAFC438C3C6F5 SHA-1: 0x055CB0333F3315A767746F13A5FF1D94B6098742	(not available)
5	%System%\CKCSP.dll	434,428 bytes	MD5: 0x0A8C13A73710F5025FA95D75A1464B1A SHA-1: 0xE920B5CE9AA1A1A1F042E176823E4475228D1C84	(not available)
6	%System%\CKKeyProCert.dll	80,976 bytes	MD5: 0x7E140664F56F7F1C62AF82EC5AA88467 SHA-1: 0x234756EB2DB9AAEB6C713685839F3EA7913F969A	(not available)
7	%System%\CKSetup32.dat %System%\CKSetup32.exe	1,260,624 bytes	MD5: 0x8C3449800924C317F27FD7ED58DF4657 SHA-1: 0xAE7C5B6F761B22D7B753755BF27768CA07F25593	(not available)
8	%System%\jrsoftcp.dll	134,224 bytes	MD5: 0xE1F0F34D5A010927056CCD30095EC072 SHA-1: 0xCA40FDE2025560F37A4F8DB807953AAE9D44EA39	(not available)
9	%System%\JRSUKD25.SYS	22,480 bytes	MD5: 0x139D9D538284EC721D759DF7238B8850 SHA-1: 0xF6E11C776F235295A8EC61970B293A1CDC5C5DC6	(not available)
10	%System%\kcrtx86.sys	126,048 bytes	MD5: 0xCBBC332B9A94D9EB16E3328B50760587 SHA-1: 0x6BF95D3165FCF545B1664509FDE6E99E7CA7DA5B	packed with PE_Patch [Kaspersky Lab]
11	%System%\kcrypto.dll	191,072 bytes	MD5: 0xF9060327C8DB272AC4BF9D52C7022AD5 SHA-1: 0x8ABF59A23A05ABD32616D6ECAD2E196C84CEE204	(not available)
12	%System%\npKeyPro.dll	261,200 bytes	MD5: 0xA4BA17E6DE9A56D2E57C9BBDE69BE042 SHA-1: 0xDD092CCBB0002543A7A1C5E324A06DACBC8A0254	(not available)
13	[file and pathname of the sample #1]	1,327,232 bytes	MD5: 0xFFC10B29F808E663C456EB67F8F210C8 SHA-1: 0xD17F33BF5117145108977254D85C6E1F1F346990	Trojan.SuspectCRC [Ikarus] packed with UPX [Kaspersky Lab]

Notes:

%DownloadedProgramFiles% is a variable that refers to the file system directory containing downloaded program files. A typical path is C:\Windows\Downloaded Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	4,198,400 bytes
ckagent.exe	%System%\ckagent.exe	139,264 bytes
CKSetup32.exe	%System%\CKSetup32.exe	1,261,568 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6CE20149-ABE3-462E-A1B4-5B549971AA38}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8FD68F8A-641E-4204-AE47-DD835C1AE756}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6CE20149-ABE3-462E-A1B4-5B549971AA38}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XecureCK
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4ABB12B3-8A8B-481D-874A-93E16F930A8B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6CE20149-ABE3-462E-A1B4-5B549971AA38}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8FD68F8A-641E-4204-AE47-DD835C1AE756}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\Contains
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\Contains\Files
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\DownloadInformation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\InstalledVersion
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@softforum.com/npKeyPro
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JRSKD24
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JRSKD24\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JRSKD24\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KCRTX86
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KCRTX86\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KCRTX86\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\JRSKD24
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\JRSKD24\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\JRSKD24\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kcrtx86
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kcrtx86\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kcrtx86\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\VersionIndependentProgID]

(Default) = "XecureCK.XecureCKKB"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\TypeLib]

(Default) = "{6385A97F-E709-4895-A9FA-DD0F420DCAC9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\ProgID]

(Default) = "XecureCK.XecureCKKB.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\InprocServer32]

(Default) = "%DownloadedProgramFiles%\TouchEnKey.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE20149-ABE3-462E-A1B4-5B549971AA38}]

(Default) = "XecureCKKB Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\VersionIndependentProgID]

(Default) = "XecureCK.XecureCKEventSink"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\TypeLib]

(Default) = "{6385A97F-E709-4895-A9FA-DD0F420DCAC9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\ProgID]

(Default) = "XecureCK.XecureCKEventSink.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}\InprocServer32]

(Default) = "%DownloadedProgramFiles%\TouchEnKey.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}]

(Default) = "XecureCKEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\TypeLib]

(Default) = "{6385A97F-E709-4895-A9FA-DD0F420DCAC9}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{503F0D5F-2BA7-4AEA-91A4-81ABBAE980A3}]

(Default) = "IXecureCKEventSink"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\TypeLib]

(Default) = "{6385A97F-E709-4895-A9FA-DD0F420DCAC9}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D9BB56B-46E9-4B44-B455-54F75D3258DF}]

(Default) = "IXecureCKKB"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\0\win32]

(Default) = "%DownloadedProgramFiles%\TouchEnKey.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\HELPDIR]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6385A97F-E709-4895-A9FA-DD0F420DCAC9}\1.0]

(Default) = "XecureCK 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink\CurVer]

(Default) = "XecureCK.XecureCKEventSink.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink\CLSID]

(Default) = "{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink]

(Default) = "XecureCKEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink.1\CLSID]

(Default) = "{80057AB5-65A5-4DF2-933F-51CFAB8E8F42}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKEventSink.1]

(Default) = "XecureCKEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB\CurVer]

(Default) = "XecureCK.XecureCKKB.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB\CLSID]

(Default) = "{6CE20149-ABE3-462E-A1B4-5B549971AA38}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB]

(Default) = "XecureCKKB Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB.1\CLSID]

(Default) = "{6CE20149-ABE3-462E-A1B4-5B549971AA38}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XecureCK.XecureCKKB.1]

(Default) = "XecureCKKB Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6CE20149-ABE3-462E-A1B4-5B549971AA38}]

Compatibility Flags = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8FD68F8A-641E-4204-AE47-DD835C1AE756}]

Compatibility Flags = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6CE20149-ABE3-462E-A1B4-5B549971AA38}]

AppName = "CKAgent.exe"
AppPath = "%Windir%\system32"
Policy = 0x00000003

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XecureCK]

DisplayName = "TouchEn Key with E2E for 32bit"
UninstallString = "%System%\CKSetup32.exe /uninstall"
DisplayIcon = "%System%\CKSetup32.exe "
Publisher = "SoftSecurity Co., Ltd."
URLInfoAbout = "http://www.softsecurity.co.kr/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\Contains\Files]

%DownloadedProgramFiles%\TouchEnKey.dll = ""
%System%\CKApp.dll = ""
%System%\CKSetup32.exe = ""
%System%\Jrsoftcp.dll = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\InstalledVersion]

(Default) = "3,1,0,4"
LastModified = "Tue, 18 Sep 2012 09:10:57 GMT"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}\DownloadInformation]

CODEBASE = "[file and pathname of the sample #1]"
INF = "%DownloadedProgramFiles%\TouchEnkey.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6CE20149-ABE3-462E-A1B4-5B549971AA38}]

Installer = "MSICD"
SystemComponent = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@softforum.com/npKeyPro]

Path = "%System%\npKeyPro.dll"
Description = "SoftForum?TouchEn?Key"
ProductName = "SoftForum?TouchEn?Key"
Vendor = "SoftForum Co., Ltd."
Version = ""

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "JRSKD24"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24\0000]

Service = "JRSKD24"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "JRSKD24"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_JRSKD24]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "kcrtx86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86\0000]

Service = "kcrtx86"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "kcrtx86"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KCRTX86]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24\Enum]

0 = "Root\LEGACY_JRSKD24\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\JRSKD24]

Type = 0x00000001
Start = 0x00000003
ErrorControl = 0x00000001
ImagePath = "%System%\JRSKD24.SYS"
DisplayName = "JRSKD24"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86\Enum]

0 = "Root\LEGACY_KCRTX86\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kcrtx86]

Type = 0x00000001
Start = 0x00000003
ErrorControl = 0x00000001
ImagePath = "%System%\kcrtx86.sys"
DisplayName = "kcrtx86"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JRSKD24\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "JRSKD24"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_JRSKD24\0000]

Service = "JRSKD24"

Other details

Analysis of the file resources indicate the following possible country of origin:

Republic of Korea

To mark the presence in the system, the following Mutex objects were created:

TouchEnKeyRunningMutex
_mtx_CKAgent_Running
@mtx_CKAgent
CKSetup32Running

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.